The "Know Your Customer" Leap: Treasury Expands Bank Data-Sharing in Trump’s Immigration Crackdown

 

 The "Know Your Customer" Leap: Treasury Expands Bank Data-Sharing in Trump’s Immigration Crackdown

**Subtitle:** *From video surveillance swaps to ITIN flags, the Treasury just widened the financial dragnet. Here is why Bessent says it’s about fraud—and why critics call it a backdoor to debanking.*

**Reading Time:** 8 Minutes | **Category:** Politics & Economy

## Introduction: The Patriot Act Pivot

On Friday, June 12, 2026, the Treasury Department quietly issued two sweeping changes to banking regulations that could reshape the financial lives of millions of Americans .

The first change expands the long-standing Patriot Act program that allows banks to share information about suspicious customers. Banks can now swap data "in real time" and more freely, sharing video surveillance footage, IP addresses, and cyber data among one another .

The second change gives banks a wider variety of reasons to share that information—including red flags historically tied to immigration status. A customer having an Individual Taxpayer Identification Number (ITIN), which is disproportionately used by undocumented immigrants when applying for work, is now explicitly cited as a potential flag .

"The information in your purview can help stop a cartel financier, disrupt a money laundering network, uncover labor exploitation, or protect taxpayers from fraud," Treasury Secretary Scott Bessent said in prepared remarks at a banking conference in Houston .

This is not a mandate. Banks are not required to collect citizenship information—a requirement the industry lobbied aggressively against for months . But as compliance experts warn, Treasury advisories have a way of becoming de facto rules.

"Once FinCEN and the prudential regulators publish specific red flags and SAR-filing instructions, banks know those materials can become reference points in exams, enforcement reviews, and internal audits," said Anisha Steephen, a former senior advisor at the Treasury Department and current fellow at the Roosevelt Institute .

In this deep-dive, we will break down the two-front expansion of bank data-sharing, analyze the $2.5 billion fraud estimate driving the policy, and explain why small banks may simply start turning away certain customers rather than risk regulatory scrutiny.

## Part 1: The Two-Front Expansion – Real-Time Sharing and New Red Flags

The Treasury's actions widen the bank data-sharing system on two distinct fronts.

### Front #1: Real-Time, Multi-Bank Data Sharing

Under Section 314(b) of the Patriot Act, banks have long been able to share information about customers when they suspect money laundering or fraud—part of the post-9/11 effort to combat terrorism .

Friday's action dramatically expands that authority. Banks can now share information with one another "in real time" and with fewer restrictions. The Treasury explicitly authorized the sharing of:

- Video surveillance footage

- IP addresses and cyber data

- Login activity from geographically distant locations

- Multiple accounts using similar identifying information 

The idea is that collaboration on suspicious cases will empower banks to bring stronger cases to federal authorities .

"This means that a bank in California can now instantly share surveillance footage of a suspect with a bank in Texas if they believe the same individual is committing fraud across both institutions," said a compliance expert who requested anonymity.

### Front #2: Immigration Status as a "Red Flag"

The second expansion is more controversial. The Treasury's Financial Crimes Enforcement Network (FinCEN) issued an advisory steering banks to flag signs that a customer may lack legal immigration status .

The advisory highlights specific "red flags," including:

- A customer having an ITIN, which is disproportionately used by undocumented immigrants when applying for work

- Identity theft patterns

- Payroll tax fraud schemes

- Shell companies associated with labor brokers

- Login activity from geographically distant places 

Bessent framed the advisory as a crackdown on fraud, not immigration.

"The advisory does not ask banks to become immigration officers," Bessent told the bankers. "It asks banks to do what they do best: know their customers, identify risk, recognize suspicious patterns, and report illicit activity when they see it" .

But critics see it differently. The administration is pushing to remove undocumented workers from the nation's banking system without explicitly mandating that banks do so .

| Authority | Pre-2026 | Post-June 12, 2026 |

| :--- | :--- | :--- |

| **Patriot Act (314b) Sharing** | Allowed for suspected money laundering/fraud | Expanded to "real time" sharing of video, IP, cyber data |

| **SAR Filing Reasons** | Fraud, money laundering, terrorism | Expanded to include potential undocumented workers |

| **ITIN Use** | Not a compliance flag | Explicitly cited as a potential "red flag" |

| **Citizenship Data Collection** | Not required | Still not required (lobbying victory) |

## Part 2: The Fraud "Hook" – The $2.5 Billion Justification

To understand why the Treasury is taking this action, you have to look at the numbers.

### The $2.5 Billion Estimate

Bessent told the bankers that payroll tax fraud schemes accounted for a staggering **$2.5 billion in suspicious banking activity in 2025** .

He tied the financial exploitation directly to the border crisis, blaming years of "unchecked illegal immigration under the Biden administration" that have allowed criminal gangs to move dirty money through the U.S. financial system .

The advisory identifies specific fraud typologies:

- Schemes involving unlawful employment

- Shady labor brokers who operate shell companies

- Identity theft used to obtain work documentation

- "Revolving door" payroll setups where workers are hired, fired, and rehired under different names 

"It's a body blow to the underground economy," a senior Treasury official said in a background briefing .

### The Data Problem

There is a catch. Since banks have never collected citizenship information on their customers, there are no reliable public figures on how much risk undocumented workers actually pose to the financial system .

One study by the left-leaning Urban Institute estimated that between 5,000 and 6,000 mortgages were issued to customers with ITINs—a tiny fraction of the millions of mortgages written each year .

Bessent acknowledged this gap but argued that the new data-sharing tools will help fill it. "Americans lose hundreds of billions of dollars to fraud each year," he said. "At Treasury, we follow the money, and we know financial institutions are often the first to see suspicious activity in real time" .

### The Criminal Justice Frame

The administration has deliberately framed the policy as a crackdown on fraud and crime, not explicitly about immigration .

"The information in your purview can help stop a cartel financier, disrupt a money laundering network, uncover labor exploitation, or protect taxpayers from fraud," Bessent said .

By attaching the new rules to well-established anti-money laundering authorities, the Treasury is on firmer legal ground—and making it harder for opponents to challenge the policy in court.

| Fraud Type | 2025 Estimated Impact | How Banks Will Flag It |

| :--- | :--- | :--- |

| **Payroll Tax Fraud** | $2.5 billion  | ITIN use, shell companies, "revolving door" payroll |

| **Identity Theft** | Not quantified | Matching SSNs across accounts, conflicting documentation |

| **Money Laundering via Cartels** | Not quantified | Suspicious cross-border transfers, cash structuring |

| **Labor Exploitation** | Not quantified | Payroll under minimum wage, unusual payment timing |

## Part 3: The "Debanking" Fears – How Banks Will Actually Respond

The advisory is not legally binding. But as compliance experts warn, ignoring FinCEN advisories can be highly risky for a bank's regulatory standing, triggering reputation-shredding probes and penalties .

### The "De Facto Rule" Problem

"When a category of customer becomes a compliance-cost and exam-risk center, institutions often respond by avoiding the category rather than serving it carefully," Steephen said .

This is the "debanking" fear. Banks may not explicitly close accounts of ITIN holders. But they may tighten onboarding procedures, make it harder to open new accounts, or exit relationships that carry perceived risk.

"ITIN holders include people trying to participate in the formal tax and banking systems, and many are exactly the lower-income immigrant households that financial inclusion efforts have tried to bring into mainstream banking," Steephen said .

### The Community Bank Squeeze

For small banks and credit unions, the burden is even heavier.

Community banks have less sophisticated transaction-monitoring systems. They rely more on manual review and documentation. The challenge is not just identifying red flags—it is demonstrating to examiners that the institution took the advisory seriously and applied a documented, risk-based approach .

"I don't expect examiners to treat the advisory as a formal checklist in name," Steephen said. "But I believe they could replicate a checklist-like approach in practice. That would likely mean asking whether banks reviewed the guidance, evaluated the impact of the red flags to their customer base and made any updates to programs" .

For community banks, the safest path may be to simply avoid the category altogether.

### The "Examiners' Rearview Mirror"

Steephen warned of a specific dynamic: "The biggest risk for banks is hindsight. If suspicious activity later appears that resembles the advisory's typologies, examiners will ask why the bank did not detect it after the agencies had put those risks in writing" .

This is the quiet power of FinCEN advisories. They are not laws. But they become reference points in future examinations. And banks know it.

| Bank Type | Likely Response | Risk of Debanking |

| :--- | :--- | :--- |

| **Large National Banks** | Update transaction monitoring, train staff, revise SAR protocols | Low (will serve with documentation) |

| **Community Banks** | Manual review, tighter onboarding, potential exit from risky segments | Moderate to High |

| **Credit Unions** | Similar to community banks; may restrict new ITIN accounts | Moderate |

| **Neobanks (Chime, etc.)** | May restrict new accounts entirely to avoid compliance burden | High |

## Part 4: The ITIN "Litmus Test" – Why a Tax Number Is Now a Flag

The most specific—and controversial—red flag in the advisory is the use of Individual Taxpayer Identification Numbers (ITINs).

### What Is an ITIN?

An ITIN is a nine-digit IRS-issued number for individuals required to file a tax return but not eligible for a Social Security number. ITINs are disproportionately used by undocumented immigrants when applying for work .

Crucially, ITIN holders pay taxes. They file returns. They contribute to Social Security and Medicare even though they cannot claim those benefits .

The advisory now cites ITIN use as a potential red flag that a customer may lack legal immigration status.

### The "Unbanked" Risk

Immigration advocates have warned that this approach will backfire.

"Any order that would order banks to collect citizenship information would likely result in undocumented immigrants moving out of the financial system, increasing the number of 'unbanked' individuals," said Nicholas Anthony, who focuses on bank regulation issues at the libertarian-leaning Cato Institute .

The unbanked—those without access to checking accounts, credit cards, or loans—rely on check-cashing stores, payday lenders, and cash. They are less traceable. They are also more vulnerable to theft and exploitation.

"Pushing people toward cash, check cashers, and informal finance is worse for households and, ironically, less transparent for law enforcement," Steephen said .

### The Mortgage Question

The Urban Institute study found that only 5,000 to 6,000 mortgages were issued to ITIN holders annually—a tiny fraction of the market .

But the advisory could chill that market entirely. If banks fear that serving ITIN holders will trigger regulatory scrutiny, they may simply stop offering mortgages to those customers.

| ITIN Holder Segment | Current Banking Access | Risk Under New Advisory |

| :--- | :--- | :--- |

| **Undocumented Workers** | Limited (checking, savings, some loans) | High (potential account closure) |

| **Mixed-Status Families** | Varies (ITIN holders may be secondary on accounts) | Moderate |

| **Legal Non-Residents with ITINs** | Full access (students, workers on visas) | Moderate (may be flagged due to ITIN) |

| **Mortgage Borrowers** | Small segment (5-6k loans annually) | High (may be frozen) |

## Part 5: The Compliance "Whiplash" – What Banks Are Actually Being Asked to Do

The advisory places banks in an uncomfortable position.

### The "Know Your Customer" Expansion

Banks are already required to "know their customers" under the Bank Secrecy Act. They already file millions of Suspicious Activity Reports (SARs) annually.

The advisory adds new categories of suspicious activity—but does not explicitly require banks to collect citizenship data.

"The statute and regulations have not changed," Steephen said. "The advisory itself says the red flags do not alter independent regulatory obligations or supervisory expectations" .

But as a former FinCEN official, Himamauli Das, noted, advisories still shape how banks deploy compliance resources and how examiners assess those efforts .

### The SAR Tagging Instruction

The advisory explicitly encourages banks to tag activity related to the executive order in their SAR filings, helping identify potentially suspicious immigration-status-related employment activity .

Banks will now need to:

- Train staff to recognize the new red flags

- Update transaction-monitoring systems

- Revise customer due diligence procedures

- Document their response to the guidance 

### The Legal "Cover"

Bessent's repeated assurance that "banks are not being asked to become immigration officers" is legally precise but practically thin .

Banks are not required to verify citizenship. But they are encouraged to file SARs when they see patterns associated with undocumented workers. And SARs are shared with law enforcement, including Immigration and Customs Enforcement (ICE).

The "clearest tell," Steephen said, "is the combination of dedicated SAR-tagging instructions and the encouragement to report tips to ICE" .

| Compliance Action | Required? | Practical Impact |

| :--- | :--- | :--- |

| **Collect Citizenship Data** | No (lobbied successfully) | Not required |

| **File SARs for Immigration-Related Patterns** | Not explicitly, but encouraged | Yes (with ICE referrals) |

| **Update Monitoring Systems** | Not explicitly, but expected by examiners | Yes (indirectly required) |

| **Train Staff on Red Flags** | Not explicitly, but expected | Yes |

| **Document Response to Advisory** | Not explicitly, but expected | Yes |

## The Bottom Line: The "Close to the Line" Policy

We started this article with a question: Is the Treasury using anti-money laundering authorities to advance immigration enforcement?

The answer is: "as close to the line as possible," in the words of the Cato Institute's Nicholas Anthony .

The administration got what it wanted: expanded data-sharing authority, real-time information exchange, and new SAR filing categories—all without a direct mandate to collect citizenship data that would have triggered costly lawsuits.

"The administration is saying they don't want banks to be immigration officials, but they are trying to get as close to the line as possible," Anthony said .

**For the Banker:**

The advisory is not a mandate. But examiners will ask whether you reviewed it, evaluated the red flags against your customer base, and updated your programs. Document your response.

**For the Immigrant:**

If you use an ITIN, you are now a compliance flag. Your accounts are not automatically at risk. But banks may tighten onboarding, and some may exit relationships to avoid regulatory scrutiny.

**For the Citizen:**

The data-sharing expansion applies to everyone. Banks can now share video surveillance and IP addresses across institutions. Privacy advocates are concerned. The Patriot Act powers were designed for terrorism. They are now being used for immigration enforcement.

**The Bottom Line:**

The Treasury expanded bank data-sharing rules tied to Trump's immigration crackdown. Banks can now share surveillance footage and cyber data in real time. ITIN use is a red flag. The policy is framed as fraud enforcement, not immigration—but the effect may be the same.

The administration got close to the line.

Whether it crossed it is a question for the courts.

---

**#TreasuryDepartment #Banking #Immigration #ITIN #PatriotAct #FinCEN #Trump #DataPrivacy**

---

*Disclaimer: This article is for informational purposes only. It does not constitute legal advice. Banks should consult their own compliance and legal teams for guidance on implementing Treasury advisories.*